Analysis
- max time kernel
24s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
02/11/2026, 11:15
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
NetExtender-10.2.0.292.msi
Resource
win10v2004-20260911-en
windows10-2004-x64
14 signatures
40 seconds
Behavioral task
behavioral2
Sample
NetExtender-10.2.0.292.msi
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
10 signatures
40 seconds
General
- Target NetExtender-10.2.0.292.msi
- Size 13.6MB
- Sample261102-ncvkwsbt9k
- SHA256 6272928ceabed46f9141fd87955bc25e66e3b907ed3bc3c27439b2714de81d3e
- MD5 5172bbb232beea0b30903f790ad1002e
- SHA1 cf77d4c9b0ba3c4ef975892c2c72b27be491fdec
- SHA512 10171862e9c4a2cdc796269115ce52eb59a095798bcf96427527b27f452237bcefaf0a6c293f3315b530bd625db7d17dcff979e8e34c6865920295f7adce9c7f
- SSDEEP 196608:imfXOhVwrl0bP0f7CIrf7K2LB7RbHhR3asX2x3t4JmAtDqNSJ5qRZz6xw:3fXOorcQ7b7JdVbBh84Jm2DqNW5quG
- TLSH T1E8E6C0C57A684075C5FB8234A917A22BF6FABC110B71C6DF52A8774D2F373D14A29322
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Loads dropped DLL 1 IoCs
pid Process 2476 MsiExec.exe - Enumerates connected drives 3 TTPs 46 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\D: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\D: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\L: msiexec.exe - Drops file in Windows directory 2 IoCs
description ioc Process File created C:\Windows\Installer\e59cccc.msi msiexec.exe File opened for modification C:\Windows\Installer\e59cccc.msi msiexec.exe - Event Triggered Execution: Installer Packages 2 TTPs 1 IoCs
pid Process 5104 msiexec.exe - Checks SCSI registry key(s) 3 TTPs 5 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr vssvc.exe Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\PartitionTableCache = 00000000040000002fc1fe242d8ae0d60000000000000000000000000000000000000000000000000000000000000000000000000000000000001071020000000000c01200000000000000000000000027010100008838012fc1fe240000000000001071020000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d0830200000000006025c501000000000000000000000700010000e841012fc1fe24000000000000d08302000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000030a9c701000000000000050000000000000000000000070001000098d4e32fc1fe2400000000000030a9c7010000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000030a9cc0100000000000005000000000000000000000007000100009854e62fc1fe2400000000000030a9cc01000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 vssvc.exe Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\SnapshotDataCache = 534e41505041525401000000700000008ec7416a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 vssvc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters vssvc.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters vssvc.exe - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 5104 msiexec.exe Token: SeIncreaseQuotaPrivilege 5104 msiexec.exe Token: SeSecurityPrivilege 6056 msiexec.exe Token: SeCreateTokenPrivilege 5104 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 5104 msiexec.exe Token: SeLockMemoryPrivilege 5104 msiexec.exe Token: SeIncreaseQuotaPrivilege 5104 msiexec.exe Token: SeMachineAccountPrivilege 5104 msiexec.exe Token: SeTcbPrivilege 5104 msiexec.exe Token: SeSecurityPrivilege 5104 msiexec.exe Token: SeTakeOwnershipPrivilege 5104 msiexec.exe Token: SeLoadDriverPrivilege 5104 msiexec.exe Token: SeSystemProfilePrivilege 5104 msiexec.exe Token: SeSystemtimePrivilege 5104 msiexec.exe Token: SeProfSingleProcessPrivilege 5104 msiexec.exe Token: SeIncBasePriorityPrivilege 5104 msiexec.exe Token: SeCreatePagefilePrivilege 5104 msiexec.exe Token: SeCreatePermanentPrivilege 5104 msiexec.exe Token: SeBackupPrivilege 5104 msiexec.exe Token: SeRestorePrivilege 5104 msiexec.exe Token: SeShutdownPrivilege 5104 msiexec.exe Token: SeDebugPrivilege 5104 msiexec.exe Token: SeAuditPrivilege 5104 msiexec.exe Token: SeSystemEnvironmentPrivilege 5104 msiexec.exe Token: SeChangeNotifyPrivilege 5104 msiexec.exe Token: SeRemoteShutdownPrivilege 5104 msiexec.exe Token: SeUndockPrivilege 5104 msiexec.exe Token: SeSyncAgentPrivilege 5104 msiexec.exe Token: SeEnableDelegationPrivilege 5104 msiexec.exe Token: SeManageVolumePrivilege 5104 msiexec.exe Token: SeImpersonatePrivilege 5104 msiexec.exe Token: SeCreateGlobalPrivilege 5104 msiexec.exe Token: SeCreateTokenPrivilege 5104 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 5104 msiexec.exe Token: SeLockMemoryPrivilege 5104 msiexec.exe Token: SeIncreaseQuotaPrivilege 5104 msiexec.exe Token: SeMachineAccountPrivilege 5104 msiexec.exe Token: SeTcbPrivilege 5104 msiexec.exe Token: SeSecurityPrivilege 5104 msiexec.exe Token: SeTakeOwnershipPrivilege 5104 msiexec.exe Token: SeLoadDriverPrivilege 5104 msiexec.exe Token: SeSystemProfilePrivilege 5104 msiexec.exe Token: SeSystemtimePrivilege 5104 msiexec.exe Token: SeProfSingleProcessPrivilege 5104 msiexec.exe Token: SeIncBasePriorityPrivilege 5104 msiexec.exe Token: SeCreatePagefilePrivilege 5104 msiexec.exe Token: SeCreatePermanentPrivilege 5104 msiexec.exe Token: SeBackupPrivilege 5104 msiexec.exe Token: SeRestorePrivilege 5104 msiexec.exe Token: SeShutdownPrivilege 5104 msiexec.exe Token: SeDebugPrivilege 5104 msiexec.exe Token: SeAuditPrivilege 5104 msiexec.exe Token: SeSystemEnvironmentPrivilege 5104 msiexec.exe Token: SeChangeNotifyPrivilege 5104 msiexec.exe Token: SeRemoteShutdownPrivilege 5104 msiexec.exe Token: SeUndockPrivilege 5104 msiexec.exe Token: SeSyncAgentPrivilege 5104 msiexec.exe Token: SeEnableDelegationPrivilege 5104 msiexec.exe Token: SeManageVolumePrivilege 5104 msiexec.exe Token: SeImpersonatePrivilege 5104 msiexec.exe Token: SeCreateGlobalPrivilege 5104 msiexec.exe Token: SeCreateTokenPrivilege 5104 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 5104 msiexec.exe Token: SeLockMemoryPrivilege 5104 msiexec.exe - Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 5104 msiexec.exe - Suspicious use of SetWindowsHookEx 3 IoCs
pid Process 5104 msiexec.exe 6056 msiexec.exe 2476 MsiExec.exe - Suspicious use of WriteProcessMemory 2 IoCs
description pid Process procid_target PID 6056 wrote to memory of 2476 6056 msiexec.exe 90 PID 6056 wrote to memory of 4988 6056 msiexec.exe 95 - Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Windows\system32\msiexec.exemsiexec.exe /I C:\Users\Admin\AppData\Local\Temp\NetExtender-10.2.0.292.msi1⤵
- Enumerates connected drives
- Event Triggered Execution: Installer Packages
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
PID:5104
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Enumerates connected drives
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:6056 -
C:\Windows\System32\MsiExec.exeC:\Windows\System32\MsiExec.exe -Embedding DD53849F7A393FED7BD2B572AED463B1 C2⤵
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
PID:2476
-
-
C:\Windows\system32\srtasks.exeC:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:22⤵PID:4988
-
-
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding 5E718918FE9E986EFCC1A6C669DA8C802⤵PID:4520
-
-
C:\Windows\System32\MsiExec.exeC:\Windows\System32\MsiExec.exe -Embedding 445A0871146C128BCAC77F70E20D8C6E2⤵PID:1916
-
-
C:\Windows\System32\MsiExec.exeC:\Windows\System32\MsiExec.exe -Embedding EA923EE778C1FB6B11C7E133A1F6C0B7 E Global\MSI00002⤵PID:3248
-
-
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding 50CD34A2BCF2D0EA53DF923499B1ACF4 E Global\MSI00002⤵PID:2860
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Checks SCSI registry key(s)
PID:260
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Config.Msi\e59cccd.rbs
- Size 1.1MB
- SHA256 264035aae9490f6c055ac5e0a9963f16739d8db532b17f92564a8b003f3d42a3
- MD5 725e5c736e87f23523e37c2ba871c88f
- SHA1 99cd04dd4409388904773197c553472a2ec45a68
- SHA512 9ed956524edc78dd982f51127c424911dc2ccd47c5dbc83bceedc48259dae608fa63256220ac8405349570cc06c1c06d7ef0eeb023223d6adf502710688ba8ca
- SSDEEP 24576:BmpY0C1Sl3wgdFFqWZmsKy49bHXnxLUF53mpY0C1Sl3wgdFFqWZmsKy49bHXnxLF:nSl3wgdFFqWZmsKy4lXKNSl3wgdFFqWm
- TLSH T16B359D217641C036D5AE01715929E73A18ADB9700FB019CBF7E85E7E9FF06D22B32A53
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\MSI7219.tmp
- Size 4.9MB
- SHA256 3c066ece536c8ae7c32ab70a5c2f278e6edc49dba61a2dbd195de08dcd186f6d
- MD5 a3ec14b98ddff0740da41068c510d98e
- SHA1 3aa732476fa379b71238ebb381c7c4f468c1296a
- SHA512 6df6c3323f3e8cdd1c79f3416182a26a2750d746cc1654ec0c3028da8b063246c76b61235c8add95d5c27d6d95a4399f83fd07abbde70f28ecb02623c5c3c54a
- SSDEEP 49152:e97s7QxVoYQ+BUmEYUbcPO/F8k1oX4xY1QCv2k7kC8yCNdTBuMe8kdPKxDmvYOrD:yfQJm/4xnokDrdINSJnayJ5qRgKzzxr
- TLSH T169368E4AA6BC41A5E577D23CC603464BE7F1BC051A72D74F01A9739E6F3B3618A1E322
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\Installer\MSID316.tmp
- Size 543KB
- SHA256 72216601ac308ff0f7d704667ea45f449cf44d3e5d69e7767120727066577fa1
- MD5 d02525f29042c87ce412e705c3d0df7f
- SHA1 a266e18a5c5029156d15b017424c15494c40b4b5
- SHA512 8336d02fc1942e818e334b1ecc769032c1ef4d5f3dc48b6bab23f94de2370f7d812bf289935cfb0b32e64ca72bd829c4f76451a87243b4dae46f1531f62334da
- SSDEEP 12288:Wm2qYYnC1N9Sl3wgdFFqWZmsAP1rdFGj49w5B6XuAdXnxLUF5tBDj:WmpY0C1Sl3wgdFFqWZmsKy49bHXnxLUL
- TLSH T18CC49D217641C036D5AE01715929E73A18ADB9700FB019CBF7E85E7E9FF06D22B32A53
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path \??\GLOBALROOT\Device\HarddiskVolumeShadowCopy2\System Volume Information\SPP\metadata-2
- Size 26.1MB
- SHA256 59d1d98d367a1d13e7f36ded34c305be5a57572b08295610af582cdd13595589
- MD5 588f364a9a11ee776fa73e1ea3da02aa
- SHA1 9edbabbabcb6606b38d5f76af0ba80eaf70b0f10
- SHA512 4cf8596465784705c557c566727e98a3e89341155303c860b6a79402460291c6a722fc85e8dc003cf145de6c54e08297e114467fbce5ff2de556d0ab6965938a
- SSDEEP 24576:kFo3DMPRdoO/vvTL/SghxClQfLu7KrWCkMHjdMP5HkvapWwxMYxWRorg1eJ:oHg
- TLSH T1CF57B31836F92101E7B7DE3DA8F0AA234D397D5B9C16DE8D05811B4E0861F71E872F6A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path \??\Volume{24fec12f-0000-0000-0000-d08302000000}\System Volume Information\SPP\OnlineMetadataCache\{c60b124c-4230-4eac-b7f7-58227338a22b}_OnDiskSnapshotProp
- Size 6KB
- SHA256 cfba3783b88c4d384e9d81cbd2f52e5751fad966870c9a66b0487f2f6aff0fbe
- MD5 41b6b33da64b59aad7f53fa0520f3d68
- SHA1 f9e45b886962a1b633b880a93b45d21be9c4af7f
- SHA512 099c0d482ef873152e8180db524b68e5e53e3747efe34935f4368ea1365bf49902dec5e811793d12f0bfde1d9aa099f843f8ac67115b67fd3515f1650f177769
- SSDEEP 96:F6t2Fvc6DD84LTHzbOHXOHBlBRQn8Sc9XE56tOSVQpuN:4ob++uVmN
- TLSH T1DFD1780C5AE54711E2B3AB7128F18557A877B911EF33CB8E0198238E6670910F975F6B
- MD5 SHA1 SHA512 SSDEEP TLSH